Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Krebs on Security

Palo Alto Unit 42

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Malware

Reddit Reverse Engineering

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Banana Squad, a threat actor first identified in 2023, has launched a new campaign targeting GitHub repositories. The group has created over 60 trojanized repositories masquerading as hacking tools written in Python. These malicious repositories contain hundreds of trojanized Python files that utilize encoding and encryption techniques to hide backdoor code. The campaign primarily uses the domain dieserbenni[.]ru, with a new domain 1312services[.]ru detected recently. The trojanized repositories exploit GitHub's UI feature where long lines of code don't wrap, allowing attackers to hide malicious code off-screen. This sophisticated technique makes visual detection challenging, highlighting the increasing stealth of supply chain attacks on open-source platforms.

The threat actor known as Banana Squad, first identified in 2023, has initiated a new campaign targeting GitHub repositories by creating over 60 trojanized repositories disguised as hacking tools written in Python. These repositories contain hundreds of malicious Python files that employ encoding and encryption techniques to conceal backdoor code. The campaign leverages GitHub's user interface behavior where long lines of code do not wrap, allowing attackers to hide malicious payloads off-screen and evade visual detection by reviewers. The malicious repositories primarily communicate with command and control (C2) infrastructure hosted on domains such as dieserbenni[.]ru and the recently observed 1312services[.]ru. This approach exemplifies a sophisticated supply chain attack on open-source platforms, exploiting trust in publicly available code and the collaborative nature of GitHub. The use of encoding and encryption complicates static analysis and detection by automated tools. The campaign's tactics align with multiple MITRE ATT&CK techniques including T1132.001 (Data Encoding), T1204.002 (User Execution: Malicious File), T1553.002 (Subvert Trust Controls), T1140 (Deobfuscate/Decode Files or Information), T1608.001 (Stage Capabilities), T1027 variants (Obfuscated Files or Information), T1588.001 (Obtain Capabilities), T1078 (Valid Accounts), T1102.002 (Web Service), and T1059.006 (Command and Scripting Interpreter: Python). Although no known exploits in the wild have been reported yet, the campaign's stealth and supply chain nature pose significant risks to organizations relying on open-source Python tools from GitHub.

Detailed information about Threat actor Banana Squad exploits GitHub repos in new campaign. Get real-time updates, technical details, and mitigation strategies.

Threat actor Banana Squad exploits GitHub repos in new campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

Threat actor Banana Squad exploits GitHub repos in new campaign

Threats Tagged 'open-source security'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'open-source security'

Lead Pen Test Professional